Filtered by tag: x-hubspot-request-timestamp.Clear filter
I am validating HubSpot webhook signatures in Python using the official SDK. I take the timestamp from the x-hubspot-request-timestamp header and pass it through float(): Signature.is_valid(..., float(timestamp)). The signature never matches and I always get a hash mismatch, even though my secret is correct. What am I doing wrong?
Do not convert the timestamp to a float. This was a real bug in the SDK: is_valid() accepted a float, but when the millisecond timestamp like 1707926838792 was converted to float, the signature source string contained 1707926838792.0 instead of 1707926838792, producing a hash mismatch every time. The fix landed in hubspot-api-python v10.0.0 and a user confirmed Signature.is_valid() worked as expected after upgrading. So update to v10.0.0 or newer and pass the timestamp as the string from the header. Also watch out: the README example used datetime.now().timestamp, which produces the same mismatch, so generate the timestamp from the header value, not from a float conversion.
Source: https://github.com/HubSpot/hubspot-api-python/issues/263
Source: https://github.com/HubSpot/hubspot-api-python/issues/263